@yarnpkg/esbuild-plugin-pnp

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
email-domain	unclaimed-email:rome.tools	AI (email-domain): The rome.tools domain lapse affects a contributor email, not the publishing account (arcanis). Package is part of the official Yarn Berry monorepo; no realistic hijack path for this package.	ai	2026/04/24
npm-metadata	no-description	AI (npm-metadata): This is a monorepo sub-package from yarnpkg/berry; missing description is a stable characteristic, not a malicious signal.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Established @yarnpkg org package published by the known Yarn maintainer; lack of provenance attestation is not a disqualifier for this package.	ai	2026/04/24

Version	Deps	Published
2.0.3	1 / 2	2022-07-21
2.0.2	1 / 2	2022-05-13
2.0.1	1 / 2	2022-02-21
2.0.0	1 / 2	2021-10-25
1.0.0	1 / 2	2021-07-26
0.0.1	1 / 2	2021-01-26